Set up a kerberos protected apache server on CentOS 6.5 x86_64

1. Install packages
# yum install mod_auth_kerb ipa-client ipa-admintools

2. Join into Kerberos domain
Make sure ipa server can resolve http server(DNS and/or hosts)
# ntpdate 0.centos.pool.ntp.org
# ipa-client-install --domain dev.id.aaf.edu.au --server iam1.dev.id.aaf.edu.au

3. Add service principal
# kinit admin
# ipa service-add HTTP/krbhttpservice.dev.id.aaf.edu.au

4. Retrieve Kerberos keytab
# ipa-getkeytab -s iam1.dev.id.aaf.edu.au -p HTTP/krbhttpservice.dev.id.aaf.edu.au -k /etc/httpd/conf/krb5.keytab
# chown apache:apache /etc/httpd/conf/krb5.keytab
# chmod 0600 /etc/httpd/conf/krb5.keytab

5. Configure apache
Open /etc/httpd/conf.d/auth_kerb.conf
#
# The mod_auth_kerb module implements Kerberos authentication over
# HTTP, following the "Negotiate" protocol.
#
LoadModule auth_kerb_module modules/mod_auth_kerb.so
#
# Sample configuration: Kerberos authentication must only be
# used over SSL to prevent replay attacks.  The keytab file
# configured must be readable only by the "apache" user, and
# must contain service keys for "HTTP/www.example.com", where
# "www.example.com" is the FQDN of this server.
#
<Location /kerberos_protected>
  SSLRequireSSL
  AuthType Kerberos
  AuthName "Kerberos Login"
  KrbMethodNegotiate On
  KrbMethodK5Passwd Off
  KrbServiceName HTTP/krbhttpservice.dev.id.aaf.edu.au
  KrbAuthRealms DEV.ID.AAF.EDU.AU
  Krb5KeyTab /etc/httpd/conf/krb5.keytab
  require valid-user
</Location>

6. Restart apache
# chkconfig httpd on
# service httpd start

7. Testing on a client machine, same as the server, you need to be a member of the Kerberos domain
# yum install ipa-client
# ntpdate 0.centos.pool.ntp.org
# ipa-client-install --domain dev.id.aaf.edu.au --server iam1.dev.id.aaf.edu.au
# kinit <username>
# curl -I -k --negotiate -u : https://krbhttpservice.dev.id.aaf.edu.au/kerberos_protected/phptest.php
The output should be like this:
HTTP/1.1 401 Authorization Required
Date: Fri, 17 Jan 2014 03:35:37 GMT
Server: Apache/2.2.15 (CentOS)
WWW-Authenticate: Negotiate
Connection: close
Content-Type: text/html; charset=iso-8859-1
HTTP/1.1 200 OK
Date: Fri, 17 Jan 2014 03:35:37 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Connection: close
Content-Type: text/html; charset=UTF-8

ipa-client-install failed with self-signed certificate

# ipa-client-install --domain dev.id.aaf.edu.au --server iam1.dev.id.aaf.edu.au
LDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.
LDAP Error: Connect error: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.
Failed to verify that iam1.dev.id.aaf.edu.au is an IPA Server.
This may mean that the remote server is not up or is not reachable due to network or firewall settings.
Please make sure the following ports are opened in the firewall settings:
     TCP: 80, 88, 389
     UDP: 88 (at least one of TCP/UDP ports 88 has to be open)
Also note that following ports are necessary for ipa-client working properly after enrollment:
     TCP: 464
     UDP: 464, 123 (if NTP enabled)
Installation failed. Rolling back changes.
IPA client is not configured on this system.
#

We need to obtain the ca.crt from the ldap server and use it to trust the slef-signed certificate.
Run these commands to fix this issue:
# wget http://iam1.dev.id.aaf.edu.au/ipa/config/ca.crt
# mv ca.crt /etc/ipa/ca.crt# mv ca.crt /etc/ipa/ca.crt

See https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/SSSD-Troubleshooting.html

Java Regex Pattern and "^M"

A simple pattern:

 Pattern title = Pattern.compile("^Alert\\s*Digest.*", Pattern.CASE_INSENSITIVE);

When I tried to match this string. It failed:

Alert Digest No 6 of 2012^M 

 Yes, you can see that "^M" in the string. This is a "line terminator" which "." will not match by default.

So the solution is:

 Pattern title = Pattern.compile("^Alert\\s*Digest.*", Pattern.CASE_INSENSITIVE | Pattern.DOTALL);

 This is the description from API document:

DOTALL

public static final int DOTALL

Enables dotall mode. In dotall mode, the expression . matches any character, including a line terminator. By default this expression does not match line terminators.

 

Invalid property 'packagesToScan' of bean class [org.springframework.orm.hibernate3.annotation.AnnotationSessionFactoryBean]

This is a maven webapp project with m2eclipse integrated into eclipse. In this project there are some hibernate dependencies used in spring-hibernate API. This is the related snippets:

    <bean id="sessionFactory"
        class="org.springframework.orm.hibernate3.annotation.AnnotationSessionFactoryBean">
        <property name="dataSource" ref="dataSource" />
        <property name="packagesToScan" value="com.seanlinxs.inventory.domain" />
        <property name="hibernateProperties">
            <props>
                <prop key="hibernate.dialect">org.hibernate.dialect.HSQLDialect</prop>
                <prop key="hibernate.show_sql">true</prop>
                <prop key="hibernate.cache.provider_class">org.hibernate.cache.NoCacheProvider</prop>
                <prop key="hibernate.hbm2ddl.auto">update</prop>
            </props>
        </property>
    </bean>

After changing the hibernate dependencies with m2e pom.xml GUI editor in eclipse many times, i.e. changing versions or something else like vendors. I found that junit runs well but tomcat deployment fail with this:

org.springframework.beans.NotWritablePropertyException: Invalid property 'packagesToScan' of bean class [org.springframework.orm.hibernate3.annotation.AnnotationSessionFactoryBean]: Bean property 'packagesToScan' is not writable or has an invalid setter method. Does the parameter type of the setter match the return type of the getter?



This is not a real issue with  AnnotationSessionFactoryBean, It is actually a jar conflict!
 E.g. In m2e pom.xml GUI editor when you see "ONE" hibernate-core, it might be "MANY" versions in the target WAR. You "remove" one dependency, then "save" the pom.xml, then add a different one, then "save" again. What you get in target WAR is two versions! You didn't really remove it though you might think you did. Run mvn clean will "REALLY" clean(empty) the target library directory and when you run mvn tomcat:deploy again everything should be WYSIWYG as expected.

 

maven-tomcat-plugin tomcat-users.xml

Here you can define tomcat-users.xml as in a real tomcat container (archetypeArtifactId: maven-archetype-webapp):


src/main/tomcatconf/tomcat-users.xml


Tomcat Maven Plugin search for a directory "src/main/tomcatconf" and if it exists it is copied to the configuration of embedded instance. 

non-administrator user on windows 7 use emacs

Today I am trying to enable manager app of Tomcat 7 on Windows 7. According to tomcat document I need to add <user> to tomcat-users.xml to grant access. I use Emacs, edit tomcat-users.xml, then save, but whatever I set the username/password/roles, I cannot login due to 401 error.

After several hours attempting I suddenly realized that I am editing wrong file! After search and compare several version of this file. I found that this is what I am editing and saving:

C:\Users\Sean\AppData\Local\VirtualStore\Program Files\Apache Software Foundation\Tomcat 7.0\conf\tomcat-users.xml

Instead of the right place:

C:\Program Files\Apache Software Foundation\Tomcat 7.0\conf\tomcat-users.xml

What happened even if I open the file in emacs using the right path? This is from Microsoft answers:

To protect against some types of malware, Windows 7 doesn't allow users to store data in C:\Windows , C:\Program Files , or their subfolders.

To allow existing programs that access those locations to run, it automatically (and transparently) translates such access to the VirtualSore folder:

C:\Windows\... --> C:\Users\"Name"\AppData\Local\VirtualStore\Windows\...
C:\Program Files\... --> C:\Users\"Name"\AppData\Local\VirtualStore\Program Files\...

That’s it, restart emacs with administrator fix it.

<error-page> catch-all feature in servlet 3.0

 

Starting with Servlets 3.0, <error-code> and <exception-type> elements are optional. An <error-page> without any <exception-type> and <error-code> will be considered as the webapp's default error page, and will act as a "catch-all" for any error codes or exception types. It will be an error if a web.xml contains more than one such default error page.
There is a example here. We want to catch ArithmeticException and display /arithmeticError.jsp instead of default /errorPage.jsp, in servlet 3.0, this is the DD:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2eehttp://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
    version="2.4">
    <servlet>
        <servlet-name>JSTLSample</servlet-name>
        <servlet-class>web.JSTLServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>JSTLSample</servlet-name>
        <url-pattern>/JSTLSample.do</url-pattern>
    </servlet-mapping>
    <error-page>
        <location>/errorPage.jsp</location>
    </error-page>
    <error-page>
        <exception-type>java.lang.ArithmeticException</exception-type>
        <location>/arithmeticError.jsp</location>
    </error-page>
    <error-page>
        <error-code>404</error-code>
        <location>/notFoundError.jsp</location>
    </error-page>
</web-app>

In previous version, DD is like this:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2eehttp://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
    version="2.4">
    <servlet>
        <servlet-name>JSTLSample</servlet-name>
        <servlet-class>web.JSTLServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>JSTLSample</servlet-name>
        <url-pattern>/JSTLSample.do</url-pattern>
    </servlet-mapping>
    <error-page>
       <exception-type>java.lang.Throwable</exception-type>
       <location>/errorPage.jsp</location>
    </error-page>
    <error-page>
        <exception-type>java.lang.ArithmeticException</exception-type>
        <location>/arithmeticError.jsp</location>
    </error-page>
    <error-page>
        <error-code>404</error-code>
        <location>/notFoundError.jsp</location>
    </error-page>
</web-app>

OCE EJBD Study Books

Enterprise Java Beans 3.1
http://www.amazon.com/Enterprise-JavaBeans-3-1-Andrew-Rubinger/dp/0596158025

JSR 318: Enterprise JavaBeans^TM 3.1
http://jcp.org/en/jsr/detail?id=318

Mock Exams from Enthuware


Ivan Krizsan's notes

OCE JSP&Servlet Study Books

Head First Servlets and JSP, 2nd Edition
Head First Servlets and JSP, 2nd Edition
Title: Head First Servlets and JSP, 2nd Edition
By: Bryan Basham, Kathy Sierra, Bert Bates
Publisher: O'Reilly Media
Formats: Print Ebook Safari Books Online
Print: March 2008
Ebook: June 2009
Pages: 912
Print ISBN:978-0-596-51668-0 | ISBN 10:0-596-51668-1
Ebook ISBN:978-0-596-55822-2 | ISBN 10:0-596-55822-8

- It's for Java EE5 version


Servlet 3.0 specification
JSR 315: JavaTM Servlet 3.0 Specification
- New for Java EE6: Synchronous Servlet and Annotation
- Familiar with:  javax.servlet, javax.servlet.http, and javax.servlet.jsp Servlet, Filter, ServletContext, ServletConfig, GenericServlet, HttpServlet, ServletRequest, ServletResponse, etc


Mock Exams from Enthuware

yaml.dump() exception lead to corrupt data

A long .yml file. yaml.load() then edit then yaml.dump() to same file. If yaml.dump() throw exception, the original file might be corrupt.

低级错误搞死了Eclipse

非常低级的错误，晕乎乎的午后所犯：

while (it.hasNext()) {
     size++;
}

程序一运行Eclipse就死了，系统也没有响应了。晕了半天才回过神：死循环。 遂改之：

while (it.hasNext()) {
     size++;
     it.next();
}

世界安静了。

Using console fonts in X

Just convert psf font to bdf font using gbdfed and put into your font directory

# sudo apt-get install gbdfed

then import a psf

Snow Leopard: Enable native NTFS read/write support Storage Devices

Snow Leopard(Mac OS X - 10.6.x) has the ability to mount NTFS volumes as read/write, but it's not enabled by default -- just read only is supported, as in 10.5. Here's how to get full read/write support for NTFS drives in Snow Leopard. First, uninstall NTFS-3G or Paragon if you're using either one.

Here's how to get read/write support for NTFS drives in Snow Leopard:

In Terminal, type diskutil info /Volumes/volume_name, where volume_name is the name of the NTFS volume. From the output, copy the Volume UUID value to the clipboard.
Back up /etc/fstab if you have it; it shouldn't be there in a default install.
Type sudo nano /etc/fstab.
In the editor, type UUID=, then paste the UUID number you copied from the clipboard. Type a Space, then type none ntfs rw. The final line should look like this: UUID=123-456-789 none ntfs rw, where 123-456-789 is the UUID you copied in the first step.
Repeat the above steps for any other NTFS drives/partitions you have.
Save the file and quit nano (Control-X, Y, Enter), then restart your system.

After rebooting, NTFS partitions should natively have read and write support. This works with both 32- and 64-bit kernels. Support is quite good and fast, and it even recognizes file attributes such as hidden files.

PuTTY connect to solaris 11 without color

Recently I connect solaris-x86 11 Express from PuTTY 0.60 but without displaying color in emacs 23.

Tried xterm/xtermc/xterm-color/xterm-256color/vt100/vt102/dtterm in configuration of PuTTY(No need to touch solaris side). Connection->Data->Terminal-type string, at last the "dtterm" is the correct one without bce(Back Color Earse) problem and works fine.

dbus/hal is not stable!

Recently I am writing some dbus/libhal programs to display mac address and some hard drive info. Programs run randomly away with this error:

libhal_ctx_init: org.freedesktop.DBus.Error.Disconnected: Connection was disconnected before a reply was received

It is totally unacceptable in this project. I need a stable solution. Just list some references here and write code to prove.

Hard Disk Metadata
The Linux /proc Filesystem as a Programmers' Tool

Perl pack/unpack notes

Original post

'b' and 'B' formats

The 'b' and 'B' formats pack strings consisting of '0' and '1' characters to bytes and unpack bytes to strings of '0' and '1' characters. Perl treats even valued characters as 0 and odd valued characters as 1 while packing. The difference between the two is the order of the bits within each byte. With 'b', the bits are specified in increasing order. With 'B', in descending order. The count represents the number of bits to pack.

Examples

ord(pack('b8','00100110')) produces 100 (4 + 32 + 64)
ord(pack('B8','00100110')) produces  38 (32 + 4 + 2)

Here "Increasing Order" means from LSB to MSB, "Descending Order" means from MSB to LSB.

'h' and 'H' formats

The 'h' and 'H' formats pack strings containing hexadecimal digits. 'h' takes the low nybble first, 'H' takes the high nybble first. The count represents the number of nybbles to pack. In case you were wondering, a nybble is half a byte.

Examples

Each of the following returns a two byte scalar.
pack('h4','1234') produces 0x21,0x43
pack('H4','1234') produces 0x12,0x34

Classes inside interface

Normally, you can’t put any code inside an interface, but a nested class can be part of an interface. Any class you put inside an interface is automatically public and static. Since the class is static, it doesn’t violate the rules for interfaces—the nested class is only placed inside the namespace of the interface. You can even implement the surrounding interface in the inner class.

TestBed: Use nested class to hold test code

public class TestBed {
    public void f() {
        System.out.println("f()");
    }
    public static class Tester {
        public static void main(String[] args) {
            TestBed t = new TestBed();
            t.f();
        }
    }
}

Nested classes

If you don’t need a connection between the inner-class object and the outerclass object, then you can make the inner class static. This is commonly called a nested class. To understand the meaning of static when applied to inner classes, you must remember that the object of an ordinary inner class implicitly keeps a reference to the object of the enclosing class that created it. This is not true, however, when you say an inner class is static. A nested class means:
1. You don’t need an outer-class object in order to create an object of a nested class.
2. You can’t access a non-static outer-class object from an object of a nested class.
Nested classes are different from ordinary inner classes in another way, as well. Fields and methods in ordinary inner classes can only be at the outer level of a class, so ordinary inner classes cannot have static data, static fields, or nested classes.

Anonymous inner class

If you’re defining an anonymous inner class and want to use an object that’s defined outside the anonymous inner class, the compiler requires that the argument reference be final.
Anonymous inner classes are somewhat limited compared to regular inheritance, because they can either extend a class or implement an interface, but not both. And if you do implement an interface, you can only implement one.

Inner vs Nested class

It’s not possible to create an object of the inner class unless you already have an object of the outer class. This is because the object of the inner class is quietly connected to the object of the outer class that it was made from. However, if you make a nested class (a static inner class), then it doesn’t need a reference to the outer-class object.